Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Assertions AHS01-03 AFR01-03 AFR01-04, AIC02 Passed
Others are N/A
Pass Rate
(%)
78.95% 15.79% 28.57% 78.95%
Instead of reporting that the partition was partially hidden, FTK Imager reported to the
user that imaging failed with error of “block index out of bounds”. FTK Imager froze
at the stage of preparing to create image, when the program was trying to acquire the
completely hidden FAT32 partition (see Sections 1.26 and 1.27 in Appendix 7).
Helix 3 Pro was not able to complete the entire imaging process. In the test case
TC-12(1) of partially hidden area, Helix 3 Pro was acquiring the image at an
extremely slow speed. The imaging process was stopped by the tester 20 hours into the
imaging process since the time for imaging an 80GB hard drive was considered
unreasonable. In the case where the partition was completely hidden, Helix 3 Pro was
not able to recognise the partition table of the hidden partition.
AIR was not able to detect and acquire the hidden data in the test drive. In the
test of partially hidden partition, AIR was able to acquire all the accessible data
correctly. On the other hand, AIR tool stopped instantly when it attempted to acquire
the completely hidden partition.
4.2.2.11 TC-13: Acquiring Overlapping Partitions
Test case TC-13 involved testing whether the disk imaging tools were able to acquire
two partitions that had overlapping boundaries (The ending address of partition A was
positioned after the starting address of Partition B). Table 4.13 shows the test results of
test case TC-13.
FTK Imager was able to recover the partition table and display the correct
information to the user. All the data acquired were correct and complete. However, the
irregularity of the partition table was not reported to the user.
82